Subject: [Bimi] DNSSC (& BIMI)

From: "Brotman, Alex" <[email-masked]>
Date: Thu, 19 Aug 2021 15:24:16 +0000

Hello folks,

We received an inquiry about requiring DNSSEC for BIMI.  The suggestion from the inquiry is that the values returned by DKIM/SPF/DMARC cannot be trusted unless utilizing DNSSEC.  I'm not sure if the OP intended to also include BIMI records as well.

One issue I do see here is that we're not currently trying to alter how SPF/DKIM/DMARC work from within the BIMI group.  They have their own groups for that.   I suppose we could make DNSSEC a requirement for just the BIMI portion, though DNSSEC adoption is somewhat low, even amongst larger companies that have the IT resources to undertake those endeavors.  While I support DNSSEC in general, I'm not sure if we want a hinderance to our goal of increasing DMARC adoption.

If nothing else, we should probably have a section addressing DNSSEC in the Security Considerations.

Any other feedback would be appreciated.

--
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast

---

From: Marcel Becker <[email-masked]>
Date: Thu, 19 Aug 2021 08:34:43 -0700

As you said, DMARC etc already have that "problem". The VMC already adds a
significant hurdle. I don't see a point in artificially adding another one.

Cheers,
Marcel

On Thu, Aug 19, 2021 at 8:25 AM Brotman, Alex <Alex_Brotman=
[email-masked]> wrote:

> Hello folks,
>
> We received an inquiry about requiring DNSSEC for BIMI.  The suggestion
> from the inquiry is that the values returned by DKIM/SPF/DMARC cannot be
> trusted unless utilizing DNSSEC.  I'm not sure if the OP intended to also
> include BIMI records as well.
>
> One issue I do see here is that we're not currently trying to alter how
> SPF/DKIM/DMARC work from within the BIMI group.  They have their own groups
> for that.   I suppose we could make DNSSEC a requirement for just the BIMI
> portion, though DNSSEC adoption is somewhat low, even amongst larger
> companies that have the IT resources to undertake those endeavors.  While I
> support DNSSEC in general, I'm not sure if we want a hinderance to our goal
> of increasing DMARC adoption.
>
> bimi mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_bimi&d=DwICAg&c=sWW_bEwW_mLyN3Kx2v57Q8e-CRbmiT9yOhqES_g_wVY&r=VjhQB5e2ZWZy73VwtJ-BdXcqOJ8fnYu3OsnoFn3B7iM&m=-Zpj9fs7Z_HMeIkq4WvqHmxYZOne30HXUaBhBNnsOok&s=kaZVYCWFK0iGZVqLF0thr2qHWbvQC5uQ0KG_YAaSvH8&e=
>

---

From: Trent Adams <[email-masked]>
Date: Thu, 19 Aug 2021 15:48:36 +0000

It's totally reasonable to add a section to the "Security Considerations" section addressing DNSSEC, but I don't think that the topic warrants more than that within this spec.

My $0.02,
Trent

From: bimi <[email-masked]> on behalf of Marcel Becker <marcel.becker=[email-masked]>
Date: Thursday, August 19, 2021 at 9:35 AM
To: "Brotman, Alex" <Alex_Brotman=[email-masked]>
Cc: "BIMI (IETF) ([email-masked])" <[email-masked]>
Subject: Re: [Bimi] [E] DNSSC (& BIMI)

As you said, DMARC etc already have that "problem". The VMC already adds a significant hurdle. I don't see a point in artificially adding another one.

Cheers,
Marcel

On Thu, Aug 19, 2021 at 8:25 AM Brotman, Alex <Alex_Brotman=[email-masked]<mailto:[email-masked]>> wrote:
Hello folks,

--
bimi mailing list
[email-masked]<mailto:[email-masked]>
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_bimi&d=DwICAg&c=sWW_bEwW_mLyN3Kx2v57Q8e-CRbmiT9yOhqES_g_wVY&r=VjhQB5e2ZWZy73VwtJ-BdXcqOJ8fnYu3OsnoFn3B7iM&m=-Zpj9fs7Z_HMeIkq4WvqHmxYZOne30HXUaBhBNnsOok&s=kaZVYCWFK0iGZVqLF0thr2qHWbvQC5uQ0KG_YAaSvH8&e=

---

From: Jonathan Leist <[email-masked]>
Date: Thu, 19 Aug 2021 11:56:21 -0400

Just wanted to concur with what's already been said. DNSSEC is really cool,
but I doubt most small business customers have the resources to implement
it. Adding it to the Security Considerations sounds ideal, but requiring it
in the spec will probably just reduce BIMI, and therefore DMARC, adoption.

On Thu, Aug 19, 2021 at 11:48 AM Trent Adams <tadams=
[email-masked]> wrote:

>
>
> It's totally reasonable to add a section to the "Security Considerations"
> section addressing DNSSEC, but I don't think that the topic warrants more
> than that within this spec.
>
>
>
> My $0.02,
>
> Trent
>
>
>
>
>
> *From: *bimi <[email-masked]> on behalf of Marcel Becker
> <marcel.becker=[email-masked]>
> *Date: *Thursday, August 19, 2021 at 9:35 AM
> *To: *"Brotman, Alex" <Alex_Brotman=[email-masked]>
> *Cc: *"BIMI (IETF) ([email-masked])" <[email-masked]>
> *Subject: *Re: [Bimi] [E] DNSSC (& BIMI)
>
>
>
> https://www.ietf.org/mailman/listinfo/bimi
>

-- 
Jonathan Leist
Senior Systems Engineer

---

From: Wei Chuang <[email-masked]>
Date: Thu, 19 Aug 2021 09:07:12 -0700

Agreed.  While a cool idea in concept (and one to revisit someday), my
understanding of DNSSEC is infrequently deployed because it's difficult to
set up and maintain, and requiring it would be a huge barrier to entry for
BIMI.  There is arguably issues with its trust model as well.
-Wei

On Thu, Aug 19, 2021 at 8:59 AM Jonathan Leist <jonathan=
[email-masked]> wrote:

> Just wanted to concur with what's already been said. DNSSEC is really
> cool, but I doubt most small business customers have the resources to
> implement it. Adding it to the Security Considerations sounds ideal, but
> requiring it in the spec will probably just reduce BIMI, and therefore
> DMARC, adoption.
>
>> As you said, DMARC etc already have that "problem". The VMC already adds
>> a significant hurdle. I don't see a point in artificially adding another
>> one.
>>
>>
>>
>> Cheers,
>>
>> Marcel
>>
>>
>>

---

From: "Brotman, Alex" <[email-masked]>
Date: Thu, 19 Aug 2021 16:28:23 +0000

Some of us have had DNSSEC for a while :) The tools for DNSSEC have gotten much better over the past few years. That said, I understand there’s consideration for projects, security, and risk.

I’ve created this as https://trac.ietf.org/trac/bimi/ticket/3

From: Wei Chuang <weihaw=[email-masked]>
Sent: Thursday, August 19, 2021 12:07 PM
To: Jonathan Leist <[email-masked]>
Cc: Trent Adams <[email-masked]>; BIMI (IETF) ([email-masked]) <[email-masked]>; Brotman, Alex <[email-masked]>; Marcel Becker <[email-masked]>
Subject: Re: [Bimi] [E] DNSSC (& BIMI)

Agreed.  While a cool idea in concept (and one to revisit someday), my understanding of DNSSEC is infrequently deployed because it's difficult to set up and maintain, and requiring it would be a huge barrier to entry for BIMI.  There is arguably issues with its trust model as well.
-Wei

On Thu, Aug 19, 2021 at 8:59 AM Jonathan Leist <jonathan=[email-masked]<mailto:[email-masked]>> wrote:
Just wanted to concur with what's already been said. DNSSEC is really cool, but I doubt most small business customers have the resources to implement it. Adding it to the Security Considerations sounds ideal, but requiring it in the spec will probably just reduce BIMI, and therefore DMARC, adoption.

On Thu, Aug 19, 2021 at 11:48 AM Trent Adams <tadams=[email-masked]<mailto:[email-masked]>> wrote:

My $0.02,
Trent

From: bimi <[email-masked]<mailto:[email-masked]>> on behalf of Marcel Becker <marcel.becker=[email-masked]<mailto:[email-masked]>>
Date: Thursday, August 19, 2021 at 9:35 AM
To: "Brotman, Alex" <Alex_Brotman=[email-masked]<mailto:[email-masked]>>
Cc: "BIMI (IETF) ([email-masked]<mailto:[email-masked]>)" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Bimi] [E] DNSSC (& BIMI)

Cheers,
Marcel

--
bimi mailing list
[email-masked]<mailto:[email-masked]>
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_bimi&d=DwICAg&c=sWW_bEwW_mLyN3Kx2v57Q8e-CRbmiT9yOhqES_g_wVY&r=VjhQB5e2ZWZy73VwtJ-BdXcqOJ8fnYu3OsnoFn3B7iM&m=-Zpj9fs7Z_HMeIkq4WvqHmxYZOne30HXUaBhBNnsOok&s=kaZVYCWFK0iGZVqLF0thr2qHWbvQC5uQ0KG_YAaSvH8&e=
--
bimi mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/bimi<https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/bimi__;!!CQl3mcHX2A!UXKWXH_6EyxRjjQK5_TsuP7G4egAXA48_xs8bvMLop708CXQJBi2QwMHdyvXXQ21EiDK$>

--
Jonathan Leist
Senior Systems Engineer
--
bimi mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/bimi<https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/bimi__;!!CQl3mcHX2A!UXKWXH_6EyxRjjQK5_TsuP7G4egAXA48_xs8bvMLop708CXQJBi2QwMHdyvXXQ21EiDK$>

---

From: Tim Wicinski <[email-masked]>
Date: Thu, 19 Aug 2021 13:26:06 -0400

As a DNS person who has done their share of DNSSEC, I agree with Alex.  The
tools are getting better, but not all managed dns vendors support dnssec
yet (though Route53 now does!).

Adding a note to Security Considerations makes sense.

tim

On Thu, Aug 19, 2021 at 12:29 PM Brotman, Alex <Alex_Brotman=
[email-masked]> wrote:

> Some of us have had DNSSEC for a while :) The tools for DNSSEC have gotten
> much better over the past few years. That said, I understand there’s
> consideration for projects, security, and risk.
>
>
>
> *From:* Wei Chuang <weihaw=[email-masked]>
> *Sent:* Thursday, August 19, 2021 12:07 PM
> *To:* Jonathan Leist <[email-masked]>
> *Cc:* Trent Adams <[email-masked]>; BIMI (IETF) ([email-masked]) <
> [email-masked]>; Brotman, Alex <[email-masked]>; Marcel Becker <
> [email-masked]>
> *Subject:* Re: [Bimi] [E] DNSSC (& BIMI)
>
>
>
> <https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/bimi__;!!CQl3mcHX2A!UXKWXH_6EyxRjjQK5_TsuP7G4egAXA48_xs8bvMLop708CXQJBi2QwMHdyvXXQ21EiDK$>
>
>
>
> --
>
> Jonathan Leist
>
> Senior Systems Engineer
>
> --
> bimi mailing list
> [email-masked]
> <https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/bimi__;!!CQl3mcHX2A!UXKWXH_6EyxRjjQK5_TsuP7G4egAXA48_xs8bvMLop708CXQJBi2QwMHdyvXXQ21EiDK$>
>
> --
> bimi mailing list
> [email-masked]

---

From: "John Levine" <[email-masked]>
Date: 19 Aug 2021 16:16:39 -0400

It appears that Brotman, Alex <[email-masked]> said:
>Hello folks,
>
>We received an inquiry about requiring DNSSEC for BIMI.  The suggestion from the inquiry is that the values returned by DKIM/SPF/DMARC cannot be trusted
>unless utilizing DNSSEC.  I'm not sure if the OP intended to also include BIMI records as well.

If that's how he feels, he can't trust the MX or A or PTR records either, so it's baffling that
he accepts any mail at all.

While I think that DNSSEC is swell and use it on all of my domains
where the registrar is cooperative, with modern DNS software the kind
of attack that DNSSEC defends against is hard to do. The most likely
scenario is a man-in-the-middle attack on your DNS cache. But if
that's happening, BIMI is the least of your problems.

I have reservations about BIMI but if your DNS is good enough to use DKIM and DMARC, it's
good enough to use BIMI.

R's,
John

---

From: Jakub Olexa <[email-masked]>
Date: Sun, 22 Aug 2021 15:00:05 +0200

I remember bringing up this topic about 2 years ago and the consensus 
was that this would be another unnecessary hurdle. We use DNSSEC 
wherever possible and .cz is somewhat forcing DNSSEC adoption (839843 
out of 1401762 domains have DNSSEC right now) this is very much an 
exception rather than a rule. Let's make a not of it, recommend it but I 
feel like with BIMI adoption needs to go first.

Jakub Olexa
Founder & CEO
E-mail: [email-masked] <mailto:[email-masked]>
Tel: +420 777 744 440 <tel:+420777744440>

Mailkit - Closing the circle between Deliverability and Engagement 
<https://www.mailkit.com>